WP Manifestindependent plugin directory
manifest / social / auto-social-publisher

Auto Social Publisher WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Automatically publishes new and updated posts to Telegram with enhanced features.

by MD ASHRAFUL ISLAM · github.com/ashrafulislamse/auto-social-publisher

★ 1stars
v2.0.0latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/ashrafulislamse/auto-social-publisher/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/ashrafulislamse/auto-social-publisher ↗
Auto Social Publisher WordPress Plugin Auto Social Publisher is a powerful WordPress plugin that automatically publishes new and updated posts to Telegram with advanced features. Version 2.0.0 introduces a premium dashboard, post pinning, and improved settings management. Key Features - Automated Telegram Posting: Automatically share new or updated WordPress posts directly to your Telegram channel or chat. - Premium Dashboard: Manage your post notifications and settings more efficiently through a new, user-friendly dashboard (added in v2.0.0). - Post Pinning on Telegram: Automatically pin posts to your Telegram channel and unpin previous ones for seamless post management. - AJAX-Based Settings: Save and update plugin settings without refreshing the page. - Enhanced Media Support: Send featured images along with your post title and summary to Telegram. What's New in Version 2.0.0 - Premium Dashboard: Enjoy a brand-new dashboard that allows for easier control of your Telegram post settings. - Post Pinning Feature: Automatically pin posts on Telegram and unpin previous posts with ease. - Bug Fixes: Fixed minor bugs and improved overall plugin performance. - AJAX Enhancements: Set

Releases

2 releases.

Tag
Published
v2.0.0 latest
Sep 28, 2024 2 years ago
Plugin
Jun 15, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Auto Social Publisher 2.0.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.0.0
Findings
1
Worst severity
high
Content hash
af9eaf621f7502c44b6902ac…

Findings

  • high Missing capability check on AJAX Telegram settings save

    missing_capability

    wp_ajax_save_auto_social_publisher_settings verifies only a nonce, then update_option() writes Telegram bot token, chat ID, channel username, and enable flags. Any authenticated user can create a valid nonce for action auto-social-publisher-nonce and overwrite these secrets, hijacking outbound posts or disabling publishing. wp_ajax_get_updated_telegram_settings similarly lacks a capability check.

    auto-social-publisher.php:44-78

    Recommendation

    Require current_user_can('manage_options') (matching the settings page) immediately after nonce verification before any update_option calls. Reject unauthorized requests with 403.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →